Your smtp should be set up so that only internal clients can access it. In Postfix this looks something like the following (obviously with your internal IP range).
smtpd_relay_restrictions = permit_mynetworks
mynetworks = 127.0.0.0/8 192.168.0.0/24
smtpd_relay_restrictions you may also want to add
permit_sasl_authenticated and set up SASL authentication for clients. You can then require all clients to be authenticated to be able to send emails outside of your servers destinations (defined by
mydestination). See here or here among many others for a detailed description of setting up SASL for Postfix.
If you set it up with
mynetworks, an external attacker (connecting from the internet) will not be able to use your smtp as an open relay. If an internal client is compromised, you have to fix that internal client, but requiring authentication from internal clients as well mitigates that risk somewhat (but a compromised client will potentially give away the credentials to the smtp server too).
Also one common mistake is when you put our smtp behind a firewall, set up your smtp to only allow local clients to send emails to external addresses, and then have your firewall rewrite packages with the source IP set to that of the firewall as opposed to the external client - so your smtp sees external traffic from the internal firewall IP address. You can fix this either by not rewriting the source address of packages, or not having the firewall address in